Windows 7 Update appears to be compromised?

Technically, if you wanted to insert malicious software into an update that is signed, one way do it might be to find a nonsense piece of text that - when hashed - appears to match an existing hash from other contents.

That's the reason MD5 is useless now - you can pad almost any data to make it have almost any MD5 that you like if you spend enough time.

But, I have to admit, it sounds more like corruption, junk, internal testing, a mistake, etc. than anything else.  But WE cannot be sure.  Only MS can provide that answer.  It wouldn't be unusual for a false-Microsoft-cert to be signed by some high-up certificate authority "for testing" which leaks out and allows someone to generate a valid, signed update with whatever they wanted in it.

Microsoft updates have specific signed certificates provided only by Microsoft.  What happened here was human oops. 

Don't panic: Microsoft mistakenly posted a 'test' Windows update patch | ZDNet:

http://www.zdnet.com/article/microsoft-accidentally-issued-a-test-windows-update-patch/

"A Microsoft spokesperson confirmed Wednesday that it had "incorrectly published a test update" and is in the process of removing it. "

Don't panic: Microsoft mistakenly posted a 'test' Windows update patch | ZDNet:

http://www.zdnet.com/article/microsoft-accidentally-issued-a-test-windows-update-patch/

Thought first this was an ackward error since I thought my WSUS database had gone full this morning...

Didn't see the .gov and .edu extension before I had copied the gabbering text and searched for it in the web. Do still have problems removing the update from the WSUS server content though...

Microsoft should come with a more official statement than through quotes on ZDNet (nothing bad said about them).

Plurable source aknowledgement... from Microsoft... would be nice  :)

You should be able to decline it from the server.  When they've oopsied before they have expired the offending update off the servers.  The next time you sync it will expire off automatically.  If it helps any I have folks that work for Microsoft confirming to me independently what the article said.